Loading story…
Progress Software disclosed and patched serious vulnerabilities in Kemp LoadMaster that could let attackers compromise load balancers deployed at the core of enterprise networks. The most prominent issue, tracked as CVE-2026-8037, was described in public advisories as affecting API methods including dodelapikey and dolistapikeys, where improper handling of memory could allow remote code execution after authentication, in some cases with root or administrator-level impact. Separate reporting also characterized CVE-2026-8037 as a critical API command-injection issue that could permit arbitrary command execution and full administrative control of the appliance.
Progress released updates to address the flaws, including patched firmware versions v7.2.63.2 and v7.2.54.18, and said the fixes also apply to ECS Connection Manager and Connection Manager for ObjectScale. A second vulnerability, CVE-2026-33691, affects the OWASP CRS handling of multipart requests by failing to normalize whitespace in filenames, creating a path to bypass firewall extension checks. Security researchers credited in the disclosures include Syed Ibrahim Ahmed and Jacky Yang of TrendAI Research, and defenders were urged to patch quickly because compromise of internet-facing load balancers could provide a foothold for deeper intrusion into enterprise environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
eSentire's Threat Response Unit reported active exploitation attempts against Progress Kemp LoadMaster vulnerability CVE-2026-8037 beginning on June 29, 2026. The attempts observed were unsuccessful and did not lead to post-compromise activity.
watchTowr Labs published a detailed exploit analysis and working proof of concept for the pre-auth root command injection flaw CVE-2026-8037 in Progress Kemp LoadMaster. The publication provided public exploitation details for the edge-exposed vulnerability after Progress and ZDI had already disclosed and patched it.
Progress disclosed and fixed two serious vulnerabilities in Kemp LoadMaster, including CVE-2026-8037 and CVE-2026-33691, and urged customers to patch immediately. The company said patched firmware versions v7.2.63.2 and v7.2.54.18 address the issues, which also affect ECS Connection Manager and Connection Manager for ObjectScale.
Zero Day Initiative publicly released advisories ZDI-26-340 and ZDI-26-341 on June 9, 2026 for remote code execution vulnerabilities affecting Progress Software Kemp LoadMaster. The advisories describe flaws in the dodelapikey and dolistapikeys methods and note that Progress had released updates to address them.
Zero Day Initiative publicly disclosed ZDI-26-338 / CVE-2026-24162 on June 9, 2026, describing a remote code execution flaw in NVIDIA Transformers4Rec's Model.load function. Exploitation requires user interaction such as opening a malicious file or visiting a malicious page.
Progress Software released updates to remediate vulnerabilities affecting Kemp LoadMaster, including issues later described in ZDI-26-340 and ZDI-26-341. Separate reporting says patched firmware versions include v7.2.63.2 and v7.2.54.18, with fixes also applying to ECS Connection Manager and Connection Manager for ObjectScale.
According to ZDI's coordinated disclosure timeline, Progress Software was notified on April 15, 2026 about a remotely exploitable vulnerability in Kemp LoadMaster later tracked under ZDI-26-341 and CVE-2026-8037. The issue was credited to Jacky Yang and Syed Ibrahim Ahmed of TrendAI Research.
NVIDIA issued an update to fix CVE-2026-24162, a deserialization of untrusted data vulnerability in the Transformers4Rec Model.load function that can lead to arbitrary code execution. The issue was credited to Javohir Abduxalilov.
Microsoft disclosed CVE-2026-26142, a critical deserialization-based remote code execution vulnerability in Nuance PowerScribe, and stated that an official fix is available. The company said the issue had not been publicly disclosed or exploited in the wild at the time of disclosure and credited Jan Rodríguez and Víctor A. Morales of GM Sectec, Corp.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
socradar.io
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software released security updates for multiple products, including **Progress LoadMaster**, **Sitefinity CMS**, and **Sitefinity Insight**, warning that the vulnerabilities could expose sensitive information, let attackers modify other users' account properties, or enable arbitrary code execution. The most severe issues disclosed were **`CVE-2026-7312`**, an insufficiently protected credentials flaw in Sitefinity web services rated **CVSS 10.0**, and **`CVE-2026-8037`**, a **CVSS 9.6** command-injection vulnerability in Progress LoadMaster. Technical analysis published after the advisory showed that **`CVE-2026-8037`** is a **pre-authentication remote code execution** flaw in **Kemp LoadMaster** when its API is enabled, affecting **GA `v7.2.63.1` and earlier** and **LTSF `v7.2.54.17` and earlier**. Researchers said the bug stems from an uninitialized heap buffer and missing null terminator in the `escape_quotes()` function used by the `/accessv2` endpoint, allowing attacker-controlled input to be incorporated into a shell command executed via `system()`. Progress patched the issue in **`v7.2.63.2`** by replacing `malloc()` with `calloc()` and adding explicit string termination, and defenders were urged to apply updates as soon as testing is complete.
Jul 10, 2026
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026
Progress released security updates for **Sitefinity CMS**, **Sitefinity Insight**, and **Kemp LoadMaster**, with the most urgent attention on multiple severe Sitefinity web-service vulnerabilities affecting versions from **8.0 through 15.4**. The Canadian Centre for Cyber Security flagged the vendor advisories and urged administrators to review Progress bulletins and apply patches. Among the Sitefinity issues, **`CVE-2026-7312`** carries a **CVSS 10.0** rating and can let an unauthenticated attacker obtain plaintext credentials used for **Sitefinity Insight** connections when that integration is enabled in a non-default configuration, while **`CVE-2026-7198`** is rated **CVSS 9.8** and allows unauthenticated access to restricted content in affected **15.4** deployments. Additional Sitefinity flaws include **`CVE-2026-7201`**, an authorization bypass that can let an authenticated low-privilege user modify other users' account properties, and **`CVE-2026-7313`**, which exposes Insight credentials to authenticated back-end users under specific configurations. Progress published patched releases including **15.4.8630**, **15.3.8531**, **15.2.8441**, **15.1.8335**, **15.0.8234**, **14.4.8152**, and **13.3.7652**, and warned that delaying remediation leaves OData and related web services open to unauthorized exploitation. The broader advisory set also includes two vulnerabilities affecting **Progress Kemp LoadMaster**.
Jun 29, 2026